Privacy Policy and Personal Data Protection Notice

Effective date: September 29, 2026 · Version 1.2 · This notice covers the Motsy Chrome extension and the motsyapp.com website.

This is an English translation provided for convenience. The legally binding version is the Turkish original; in case of any inconsistency, the Turkish text prevails.

1. Data controller and contact

Motsy is developed and provided by Mert Göktaş. The data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) is:

• Name: Mert Göktaş
• Address: Denizli, Türkiye
• E-mail: privacy@motsyapp.com

You can use this address for any question, request or objection about your personal data; the request procedure is described in Section 11.

Data Controllers' Registry (VERBİS): Under the exemption decisions of the Turkish Personal Data Protection Board, controllers with fewer than 50 employees and an annual balance sheet below the threshold set by the Board, whose main activity is not processing special categories of data, are exempt from registration. Motsy falls under this exemption; if the conditions change, registration will be made.

2. Scope and definitions

This notice covers two services:

• The Motsy extension: a browser extension for Google Chrome that shows bilingual subtitles on Netflix and YouTube and helps you learn vocabulary, together with its dashboard.
• The website: the marketing site at motsyapp.com.

Netflix and YouTube are not part of Motsy; your accounts and data on those platforms are governed by their own privacy policies.

3. Which data we process

The table below lists every type of data Motsy stores, where it comes from and where it is kept. Nothing outside this table is stored.

3.1 Your account

3.2 The words you save and their context

When you save a word or phrase, the following is stored:

Audio clips and scene frames are kept in a private file area (Cloudflare R2, European Union) that can only be opened with your account; their links are short-lived and cannot be accessed from outside.

3.3 AI usage and usage counters

The AI in Motsy is not a free-form chat tool; it does not let you write your own prompts. The AI is called only for three fixed functions, with predefined prompts, and only through our server:

• Word card — "Contextual Meaning (AI)": the meaning of the word you clicked in that sentence.
• Word card — "Sentence Structure Analysis": an explanation of the elements of the sentence the word appears in.
• Quiz — distractor options: automatic background generation of the wrong answer options when you review a word you saved. This request is triggered by starting a review, not by anything you type.

Each call sends only the word in question, the single sentence it appears in, and the language pair; the prompt text is built on the server, and the extension cannot send raw prompts to the server. To prevent abuse, the number of requests per user per day is limited; when the limit is reached, the feature becomes available again the next day. The counter kept for this purpose is only a number; it does not contain the content of the request.

3.4 Data kept on your device

The extension keeps the following in its own private storage area (Chrome extension storage): your session token, language preferences, interface settings and a small cache of previously translated words. This data does not leave your computer and is deleted when you remove the extension.

3.5 Technical logs

On the server side, short-lived technical logs are kept to monitor the service and find errors (request time, result status, user ID, size of AI requests). Logs do not contain your password, session token or subtitle text.

4. Data processed but not stored

Some data is processed only momentarily to run a feature and is never stored anywhere:

• Subtitle text: Netflix's and YouTube's own subtitle files are held in memory while you watch, in order to show the dual subtitles. They are discarded when you close the video and are not sent to our server.
• Words you click or hover over: Sent to the services in Section 7 for translation and meaning; stored only if you save them.
• Password breach check: During sign-up and password change, only the first 5 characters of an irreversible hash of your password — never the password itself — are sent to the Have I Been Pwned service. With this method, the other side cannot learn your password.

5. Data we do not collect, and permissions

Motsy does not access or collect: camera, location, browsing history, your Netflix or YouTube account details, your watch history, payment details, your contacts, or content in other tabs. The extension shows no ads, runs no ad network, and uses no analytics or tracking tools.

The permissions the extension requests from Chrome, and why:

6. Purposes and legal bases

Your data is not processed for marketing e-mails, profiling, automated decision-making or advertising. None of the processing above relies on explicit consent, and explicit consent is never made a condition of the service. If processing that requires explicit consent is ever added, it will be requested through a separate, freely withdrawable consent.

7. Who we share data with

We never sell your data and never share it with other users. To provide the service we work with the following service providers; each is limited to the stated purpose and to the data that is strictly necessary.

Beyond these, data may be shared only where legally required (for example a court order) and only to the extent required.

8. International transfers

Your data is processed on servers outside Türkiye. Below we explain which data is kept where and under which legal safeguard it is transferred.

8.1 Where the data is

8.2 Users located in the European Union (GDPR)

Your account data and files are kept inside the European Union (Germany); a data processing agreement incorporating the European Commission's standard contractual clauses is in force with Supabase. Transfers to Google, Microsoft and Resend rely on the European Commission's standard contractual clauses under Article 46 GDPR and on these providers' certifications under the EU–US Data Privacy Framework.

8.3 Users located in Türkiye (KVKK)

Under Article 9 of the KVKK (as amended by Law No. 7499), because the Personal Data Protection Board has not issued an adequacy decision for any country, transfers abroad must rely on one of the appropriate safeguards listed in the Law. For this purpose Motsy relies on the standard contracts published by the Board ("Controller to Processor"); every signed standard contract is notified to the Board within five business days of signature. Because a transfer based solely on explicit consent is, by law, limited to incidental (one-off) transfers, it is not used as a legal basis for continuous processing, and you are not asked for explicit consent for this purpose.

Your account data and files are kept inside the European Union under the contractual safeguards of the GDPR (8.2). The status of Türkiye standard contracts per provider will be updated in this section as they are completed; you can ask about the current status at privacy@motsyapp.com.

8.4 We keep transferred data to a minimum

• Only the word you clicked and the single sentence it appears in are sent to AI and translation services; your account details, e-mail or identity are not sent.
• The Gemini API is used on the paid tier; Google does not use this content to train its models and retains it only for a limited time for abuse monitoring.
• In the password breach check, only the first five characters of an irreversible hash — not your password — are sent; this does not constitute a transfer of personal data.

9. Retention and deletion

• Your account and everything you save: Kept for as long as your account is open.
• Account deletion: You can permanently delete your account with "Delete Account" in the profile menu of the dashboard. Your account, words, sentences, audio clips, scene frames and progress are deleted at the same time. This cannot be undone.
• Individual deletion: You can delete saved words one by one from the dashboard at any time; the attached audio and image files are deleted too.
• Technical logs: Kept for at most 7 days depending on our server provider's plan, then deleted automatically.
• Usage counters: Daily AI request counters are deleted automatically after 30 days.
• Data on your device: Deleted by Chrome when you remove the extension.

10. Security measures

• All communication takes place over encrypted connections (HTTPS/TLS); data and files kept on the server are stored encrypted at rest (AES-256).
• Passwords are stored as irreversible hashes; at sign-up and password change they are checked against breached password lists, and a minimum of 12 characters is required.
• Row-level access rules are enforced in the database: each user can access only their own data; unauthenticated requests cannot reach any data.
• Audio and image files are kept in a private area; only the owner can access them, through short-lived signed links.
• Access keys for the AI and e-mail services are not embedded in the extension; they are kept only on the server.
• Input length limits and a per-user daily quota are enforced on the server side.

No system is one hundred percent secure. If we detect a security incident affecting your data, we will inform you and the relevant authorities within the statutory deadlines.

11. Your rights

Under Article 11 of the KVKK and Articles 15–22 of the GDPR you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used in line with that purpose;
• know the third parties to whom the data is transferred, in Türkiye or abroad;
• request correction of incomplete or inaccurate data;
• request erasure or destruction of the data under the conditions of Article 7 of the Law (you can do this instantly from inside the app);
• request that corrections and erasures be notified to the third parties to whom the data was transferred;
• object to a result that is to your detriment arising from analysis by exclusively automated systems (Motsy performs no such analysis);
• claim compensation for damage suffered as a result of unlawful processing;
• under the GDPR, additionally: receive your data in a portable format, object to processing, request restriction of processing, and lodge a complaint with the supervisory authority in your country.

Request procedure

You can send your requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, to privacy@motsyapp.com from the e-mail address registered to your account, or in writing to the postal address in Section 1. Your request must include your first and last name, the subject of the request and (for written requests) your signature; writing from the e-mail address registered to your account is sufficient to verify your identity. Requests are answered free of charge within 30 days at the latest; if the operation entails a separate cost, only the fee in the tariff set by the Board may be charged.

If your request is rejected, the answer is found insufficient, or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the request date. If you are located in the European Union, you may apply to the data protection authority of your country.

Data breach notification

If your personal data is obtained unlawfully, the incident is notified to the Personal Data Protection Board within 72 hours of becoming known, under Article 12 of the KVKK, and to the competent authority under Articles 33–34 of the GDPR; affected users are informed as soon as possible at the e-mail address registered to their account.

12. Children

Motsy is not designed for children under 13 and does not knowingly collect data from them. Users located in Türkiye who are under 18 may use Motsy only with the consent of a parent or guardian; in the European Union the applicable limit is the age set by the relevant country (13–16). If we discover an account opened contrary to these rules, we delete the account and its data. Parents can write to privacy@motsyapp.com about this.

13. Cookies and local storage

The extension does not use cookies. The website uses no analytics, advertising or tracking cookies; it only saves a preference in your browser's local storage to remember the language you chose. Aggregate visitor statistics for the site (page views, referring site, country, device type) are collected with cookie-free Cloudflare Web Analytics; individual visitors are not tracked. The YouGlish frame shown inside the extension may use YouGlish's own cookies, which are subject to YouGlish's privacy policy.

14. Chrome Web Store disclosure

Motsy's use and transfer of information received from Google Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. User data is used only for the extension's single stated purpose (learning languages while watching Netflix and YouTube); it is not used for advertising, is not sold, is not processed for purposes such as creditworthiness, and is not read by humans (except where required by law or for security investigations).

15. Changes

When we update this notice, we change the effective date and version number, and for significant changes we inform you inside the extension or by e-mail. A change that widens the scope of our data processing does not take effect before you have been informed.

This document was drafted in Turkish. Versions in other languages are provided for convenience; in case of any inconsistency, the Turkish text prevails.